OPNsense config line injection via multiple GUI text fields
Users with only partial settings access could take over the firewall.
Summary
An authenticated Web UI or API user with delegated settings access can insert line breaks into input fields and add attacker-controlled directives to privileged service configuration files. Versions before 26.1.11 and 26.4.1p1 are affected, and root command execution through Monit configuration was demonstrated.
Affected when
- authenticated Web UI or API user with delegated settings access
- OPNsense before 26.1.11 and 26.4.1p1
What to do
Update to 26.1.11 or 26.4.1p1.
Update to at least the version for your product:
- OPNsense 26.1 26.1.11 or later
- OPNsense 26.4 26.4.1p1 or later
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen